Shibboleth IdP as the hub in a hub and spoke federation

[Scott Koranda]

On Mon, Mar 3, 2014 at 2:02 PM, Tom Scavo <trscavo at gmail.com> wrote:
> On Mon, Mar 3, 2014 at 2:28 PM, Scott Koranda <skoranda at gmail.com> wrote:
>>
>> Can anyone report success using a Shibboleth IdP as the "hub" in a hub
>> and spoke configuration/federation
>
> AFAIK, JP Robinson @ UAB first solved this problem around 2006. Yes,
> Shibboleth can be configured as an IdP Proxy (which is what you're
> asking, I think) but no, it is not best suited to the problem.
> SimpleSAMLphp is a much better fit.
>
>> (presumably by coding a custom login handler)?
>
> I don't have the specifics of how JP did it. In effect, a Shibboleth
> SP protects the IdP SingleSignOnService endpoint. As I understand it,
> the SP simply passes REMOTE_USER to the IdP.

Thanks.

I am especially interested in hearing of solutions that do not use the
REMOTE_USER login
handler in order to support isPassive and forced re-authentication.

Scott K